After Lab 2.4 — Recap

After the private endpoint and DNS configuration:

curl https://<db-storage-table-endpoint>           = blocked
Public Backend API → Internal Backend → DB Storage = works
Public API /api/data-demo                          = works

The public path is gone. The application is unchanged. Defense in depth now has three layers on the data access path: network (private endpoint), identity (managed identity + RBAC), and encryption at rest (always on).

Key takeaway

A private endpoint removes the public network path. The application does not change. Only the attack surface changes.

Figuur 0: Table Storage private endpoint — NIC with private IP visible in the Azure Portal

Figuur 0: Storage account networking settings — public network access set to Disabled

---

Bridge to data protection theory

A private endpoint protects the network path to your data. The next page covers the broader data protection picture — encryption, key management, TLS enforcement, and storage account configuration — before we apply them in Lab 2.5.